goauthentik Environment Variable improper authentication

Summaryinfo

A vulnerability was found in goauthentik authentik. It has been classified as critical. Impacted is an unknown function of the component Environment Variable Handler. Performing a manipulation results in improper authentication. This vulnerability is known as CVE-2023-46249. Remote exploitation of the attack is possible. No exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in goauthentik authentik (unknown version). It has been classified as critical. This affects an unknown code block of the component Environment Variable Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.

The weakness was published 10/31/2023 as GHSA-rjvp-29xq-f62w. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-46249 since 10/19/2023. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Applying the patch 261879022d25016d58867cf1f24e90b81ad618d0 is able to eliminate this problem. The bugfix is ready for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• goauthentik

Name

• authentik

License

• open-source

Website

• Product: https://github.com/goauthentik/authentik/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion